The Inspector General of the Office of Personnel Management found “significant deficiencies” in the process for hiring contractors to protect millions of federal employees whose personal information was accessed by hackers linked to China last year.

“We determined that the [Office of Personnel Management] did not award the … contract in compliance with the [Federal Acquisition Regulation] and [Office of Personnel Management] policies and procedures, which led to [the agency] selecting the wrong contracting vehicle,” Patrick McFarland, OPM Inspector General, wrote to OPM Director Beth Cobert, according to the Washington Post.

“While we are unable to determine whether the issues we uncovered are significant enough to have impacted the award of the contract…it is evident that significant deficiencies existed… over the contract award process.